Skip to content

ADR-0007 — Provisioning of plugins and artifacts (community modules, in-house plugins, images)

Date: 2026-09-01 · Status: proposed

Context

GeoServer community modules are not shipped on the download page (only nightly builds). Verified on 2026-09-01: the OSGeo Nexus (https://repo.osgeo.org/repository/release/org/geoserver/community/) nevertheless publishes release JARs aligned with each tagged version (gs-jdbcconfig, gs-jdbcstore, gs-cog*, gs-s3-geotiff, gs-hz-cluster, gs-jms-* in 3.0.1). Stable extensions are on SourceForge. Our in-house plugins are compiled by us. Long-term build reproducibility cannot depend on the availability of public repositories.

Point of attention: a GeoServer plugin is generally a set of JARs (the module plus its third-party dependencies). The OSGeo Nexus only publishes the module's JAR; the dependencies are in the nightly zip, whose version (3.0-SNAPSHOT) does not match the release (3.0.1). For gs-jdbcconfig / gs-jdbcstore the JAR alone is enough (dependencies already in GeoServer); for the cluster modules (Hazelcast, ActiveMQ) or S3 (AWS SDK) the full bundle is required.

Decision (proposed)

  1. Corporate artifact repository (Nexus or Artifactory) with: a proxy of repo.osgeo.org (release) and of Maven Central, a hosted repository for our plugins (org.example.meteogis:*) and, as a fallback, the community JARs fetched manually or built from source. The Dockerfile points at this repository (NEXUS argument).
  2. Corporate image registry for the built images; base images and extensions pinned (exact version, ideally digest).
  3. Release-aligned community bundles resolved by Maven: starting from the module's release POM on the OSGeo Nexus, mvn dependency:copy-dependencies (runtime scope) excluding the artifacts already present in the image's WEB-INF/lib, then a zip published in the hosted repository. This is the method retained for the cluster modules (sub-project 3) and S3 rasters (sub-project 4).
  4. Building from source only for modules absent from the OSGeo Nexus or requiring a patch: clone the GeoServer repository at the tag, mvn -pl src/community/<module> -am install, publish into the hosted repository.
  5. No download at pod startup (already established, ADR-0005).

Rejected alternatives

Alternative Why rejected
Depending directly on public repositories in production Unavailability or withdrawal of artifacts = build impossible
Committing the JARs into the code repository Bulky, no version management or provenance
Building all modules from source Costly and unnecessary as long as the OSGeo Nexus publishes the releases

Consequences

  • To be worked out with the platform team: which tool already exists (Nexus, Artifactory, GitLab Package Registry…), retention policy.
  • The Dockerfile remains unchanged: only the base URLs change.